Bringing Plex Home to the Gateway: One HTTPRoute with Two Doors, a ClusterIP Service, and the Passthrough Lane Retired

Overview

Plex is the last resident and the highest-stakes move. Its public access rode a passthrough lane at port 32400 to a MetalLB address, and the household reached the same address directly. This appendix puts it behind the Gateway: one HTTPRoute attached to both HTTPS listeners, so the LAN door answers the private name and the WAN door answers the public one through the edge's SNI relay, with no edge change. The Service becomes ClusterIP and the passthrough lane retires. Two traps on the way: the advertised address list passes through Helm strvals, where a comma separates assignments, and the frpc restart that drops the old lane forces a DNS lookup of the tunnel's control endpoint, which has to track the edge's naming.